Palo Alto Networks K2-Series Reviews

The primary use for this solution depends on the preference of a customer and to some extent their existing environment.  

We have to establish things like:  

• what are the business requirements  
• how we can utilize what is existing or if the client needs to upgrade equipment  
• what kind of servers do we put in  
• what kind of servers does he have on cloud  
• what kind of servers do we have on-premises  

So it all depends on the customer's requirements. If a query comes up with a client, I am happy to answer that and provide a resolution but the situation needs to consider specific needs.  

The thing I like the most about Palo Alto is that the IPS system is the strongest you can get. Even if you check with resources like the NSS Labs or Gardner — anywhere else — they all say it has the strongest IPS. It holds true even over the past five years. They are the leaders in the field.  

The reason I believe in my eyes that the IPS is the most valuable feature in Palo Alto is that the IPS is basically protecting everything. I think every two or three hours the database for the IPS signatures gets updated.  

One more feature of Palo Alto, which is not in Fortinet if you compare, is decryption. Palo Alto firewalls are doing SSL inspection and they are doing decryption as well. If we need SSL inbound inspection it is available in Palo Alto but Fortinet does not have this feature. They are not doing SSL inbound inspection. It is one more thing I would like to include as a positive feature of Palo Alto in my opinion.  

There is not really anything that needs to be improved in the product. It might be nice if it were possible for newer users to get a higher level of support.  

The company I work for now is a business I more recently joined. It has been about two years with the company but I have been dealing with Palo Alto products for 10 years now.  

We are talking about a firewall and we are not talking about a simple machine. We are talking about a machine that is not something you can just make simple. We are not talking about a general machine, so it does not really have general features. It does have multiple features. It does have processing engines — the parallel processing of Palo Alto — which is great. The stability will depend on the configuration and use. You really only have two options. You can either go for Palo Alto, or with Fortinet. These are the leaders of network security right now, so I guess those are stable or they would not be popular.  

Palo Alto has got a lot of customers now — even in the middle East. Almost every version has been scalable. That is the main reason that people are buying the product. I am satisfied with the scalability.  

The quality of technical support usually depends on your support level. If your support level is 24/7 365 then obviously your support is going to be perfect. But if you did not purchase that support, you will have some other level of support which is not 365 days. For example, they have an option for eight-by-seven which is eight hours per day seven days a week or something like that. The eight-by-seven support is not good in that case if you need it often or at times when it is not available.  

I have worked for Palo Alto as well as consulting about their products and they are really good at what they are doing, but there are pros and cons for every product. This applies especially to the goals when it comes to support. Most of the customers are not educated enough to do hands-on technical stuff on a product that is new for them every time even if they have experience with similar products. They need support because the basic concepts are essentially the same for firewalls everywhere, but the operating system and the way it does the processing is different for every type of firewall. So new users of Palo Alto may require support to set up most of the things, and if a user does not have the level of support he needs, he will be facing issues. He will not be able to finish his work on time.  

I really feel that all products have some level of technical support issues. Every product has pros and cons and even in the support level. A lot of times we will not find support in our same region. It would be located in different regions. So it happens to be pretty much normal for IT. People probably do not feel that is a good issue to face, but issues in the support are actually fine. That is manageable.  

I do have experience using next-generation firewalls, traditional firewalls, NDN (Named Data Networking) firewalls, distributed firewalls, and NSX. We still use various products but I prefer to use Palo Alto because of its capabilities.  

I am actually satisfied with the pricing of Palo Alto even though it is expensive. If you are talking about using products by a leader in the field and it is a bit expensive compared to other vendors, then that is totally fine for me because you are not compromising your security. In many other cases — like if there are budget issues — the companies can always go for Fortinet. It is also a good firewall, but it is cheaper. If you have got the budget to purchase Palo Alto, get it. If you do not have the budget, go for Fortinet or any other firewall.  

When we were looking for some different solutions, I was looking for comparisons between AlgoSec's firewall and others. I have been trying to research basically right now before purchasing another solution. We are looking for firewall management. We have multiple-vendor firewalls and we are looking to manage them from one console. From there I can manage all my multi-vendor firewalls, DMZ, internal firewalls, group firewalls, et cetera. That is why I was looking at AlgoSec, because it is capable of doing re-certification as well as integrating with NSX as well. There are a lot of things it can do. AlgoSec seems to meet my basic requirements for the solution.  

We are using multiple vendors like Cisco, Palo Alto, Fortinet, and Juniper. We are not limited to one vendor. We have different environments and different firewalls for each environment.  

But mostly, in the current market over here, the clients are preferring to go with Palo Alto as a DC (Data Center) firewall to use internally because IPS (Intrusion Prevention System) is really strong. As for Fortinet, people are preferring that as a solution for DMZ.  

On a scale from one to ten where one is the worst and ten is the best, I would give Palo Alto a rating of nine-out-of-ten.  

I would not give the product a ten and it is not really because there are additional features can be included to make it a perfect ten. Nobody is perfect. Based on smaller support issues is not really something I can rate a product on. Based on their performance in being a leader of these technologies and the leaders and the inventors of next-generation firewalls — based on that, I am giving them a nine. They have better processing which Palo Alto is the only one doing. Based on that and IPS system I give them a nine. And because I am not a perfect guy, I keep one Mark.  

Generally, the solution is used as a perimeter-based firewall with a secondary firewall covering the servers.

Benefit wise with the speed of deep packet inspection, we've found it will assist with a quicker resolution to a potential false-positive alert. You're able to drill down. It's a third to probably 75% faster than a lot of the other premier firewalls on inspections. Therefore, your root cause analysis will then come to a resolution quicker. It's all about speed.

The deep inspection functionality is great.

The solution scales well.

As long as the solution is kept updated, it's pretty stable. 

The solution provides a lot of value to the client.

The licensing cost is a typical complaint with many clients. The solution is expensive.

In terms of automation, they could get better with it, especially with third-party integration. There are not too many products that will integrate with ease to the Palo Alto product set. They keep things locked down quite hard, which technically is also a benefit. That said, third-party integration definitely would be a benefit to us, as most of our implementations are two or even three different firewalls. Having third-party tools that integrate with all three or all two other products would be a benefit.

I've used the solution since it came out, about seven years ago.

The stability of the product has to be put into a relative context. If people keep it upgraded and maintained, there are generally no issues. If they let it fall behind and we have to do a catch-up or leapfrog versions then there could be other complexities.

The solution is scalable. If a company puts in at the right requirements and they double it by 50%, which you should always do, then there is lots of headroom until the next refresh cycle.

Any type of company can leverage the solution, from smaller organizations to very large enterprises. The main difference is if there's a higher security environment, the solution requires more attention. However, it has the capability to handle any size of setup.

I've never directly spoken with technical support and therefore cannot speak to how helpful or responsive they are. 

The solution is complex due to the fact that the salespeople from Palo Alto, or even from my firm will say, oh, we can just use this import wizard. However, that works to about a 60% level, and it does not do a complete import of Fortinet to Palo Alto or Cisco to a Palo Alto or Check Point to a Palo Alto.

That's where the complexity comes in. The customer thinks it's going to be easy. The salespeople said it's going to be easy. However, it really is not.

The time it takes to implement the solution is a hundred percent dependent upon the requirements of the solution. I've had firewalls taking six months to implement in a large retail environment and I've had also firewalls where you walk in and they give you just outbound requirements, and boom, it's up and out in two hours. That's why it really depends upon the complexity of the requirements.

The cost of the product is quite high.

I deal in list price. I don't get into discounting due to the fact that I do everything on a solution based on the list price. I have seen super heavy discounts from Palo Alto, however.

The licensing for Palo Alto is very straightforward. They include a lot in their base license. However, there may be features in there that are included and are buried in the base licensing cost that the customer will never use.

We're partners with Palo Alto. 

I'm dealing with all different versions of the solution and not necessarily just the most recent version. While most of what we work with is on-prem, many people are now moving to the cloud.

I would advise those considering the solution to ensure that they have a knowledgeable installer. That is critical. Most of ours that we take over are watched installs.

I rate the product at a nine out of ten. From a security/cost-benefit perspective, it's one of the best.

Until recently, most of my time was spent implementing this product and our company still does that. As a security solutions architect, I'm now more focused on the architecture and that side of things. We're partners with Palo Alto. 

It's a very good product, simple to use. The visibility is very, very important, and that's good with Palo Alto. The solution has simple integrations with the domain controllers and other inventories, which the endpoint traps by cloud which is very important. It's an easy firewall, very easy to configure, to monitor, and to use. It's easier than Forte, for example. 

The solution could be improved with more dedicated reporting about the user's context. For example, if I need to have a summarized report that includes uses as well as consolidating the user's activities, threads and applications on the endpoint machine, Palo Alto does not have the visibility for the endpoint in their firewalls. If I want to have a report from the firewall that summarizes user application from the user side, rather than the server side, Palo Alto software does not have that information.

Other vendors, such as Cisco, have that in their profile. You can generate a report from Cisco firewall and it will tell you that you're using the internet, and using Firefox or Google Chrome. Palo Alto doesn't have that extended visibility to the end point. 

It would be the same for additional features - I need to have the visibility of the endpoint application, endpoint context. It's an innate feature in Cisco firewalls. I don't like the style of Forte, for example. It has email spam over the firewall. I don't like this feature, and I don't like to have features that are not really good for out of the box. What Forte does have that is good is an explicit proxy capability and Palo Alto could include that.

I've been using this solution for more than 10 years. 

Palo Alto is stable. They used to have some issues but now they're good. All software has a vulnerability, but stability here is fine.

It never used to be scalable but they've recently added a cluster mechanism so you can scale as much as you need. I've spoken to them and they're going to make an announcement about it later in the month if they haven't already. 

Palo Alto support is good, I contact them all the time. They have two kinds of support: Premium, which allows you to contact the vendor directly, they open the case, and you communicate with Palo Alto and they'll help you on the spot. There is also Partner support. I would not recommend that to anyone. 

Palo Alto is the easiest solution in this field to implement. 

Implementation depends on the use case. For example, if you implement on the edge, or you implement on-prem, or you implement on the internet, it's different from implementing to the data center. It's generally a quick process. It might take around two weeks, depending on the number of applications in the data center. If you're using solutions like Forte or Cisco, they will take longer. 

The number of people required to implement also varies depending on how you plan to implement - whether over the internet or if you deploy through the application theme. It requires communication between all parties. 

It's a good product. I would suggest people think about the design, the architecture, what they have and the applications. If they have a different kind of firewall, if they have an internet firewall, they can use the Palo Alto tool. Or they can use something else depending on what they have on their network.

I recommend Palo Alto because it's a platform as well as a firewall and it has a lot of features. I would suggest testing the features and trying to get all the benefits of all the functions in the box. 

I would rate this solution a seven out of 10. 

The solution was a firewall that bridged the internal systems with their DMC equipment and/or restricted systems access that wasn't generally available to anyone outside of the organization.

The solution gets the access controls down to an even more precise part of the network traffic. It's not just any user going to an IP address or going to a port to get on the network. It's very thorough.

Our organization liked the fact that it wasn't just firewalls that handled addresses and ports. It also handles actual URL inspections. 

The solution is at the cutting edge of technology. 

The solution has good at controlling restricted access.

Palo Alto has better and finer controls than, say, Cisco or Check Point.

The solution is very strong from a security standpoint.

It's like anything else. What's good today might not be in a day, a week, a month, etc. The solution needs to constantly be adapting and updating.

The solution needs a series of OS changes.

I have been using the solution for five years.

The stability of the solution is rather excellent. It is really stable unless somebody messes up a configuration. We didn't face any bugs or crashes or have any issues with glitches.

The solution was scalable for our purposes. We distributed it to three or four different locations and these were all internal edge firewalls. It wasn't more than a half a day to get any new location up, once the network equipment was in place. (For example, switch hardware, cables, etc.). We would just bring in the hardware, set it up, connect to it, and finish turning it on.

The technical support is excellent. There haven't been problems that they couldn't resolve quickly. Pretty much are all cases that we had were dealt with to our satisfaction.

Prior to Palo Alto, we had been using Check Point. There wasn't a technical reason that we switched. As an organization, we just periodically switch technologies.

I can't really answer any questions related to the initial setup as there was another person who handled it. However, I do believe it was straightforward for them. My understanding was that deployment only took a day. It wasn't a long process.

For the initial deployment, I'm pretty sure they used a subject matter expert. After that, the organization did not need outside assistance. One of our own team members ended up becoming the subject matter expert for a lot of the implementation strategy.

I don't have an idea of what the licensing costs are.

I'd advise companies considering setting up the solution to make sure they have a trained team. If the team doesn't have any expertise with this type of firewall, then they've got to take some training. The training's pretty good and once you understand the concepts, it's pretty quick to put together. 

At the time we implemented it, it was easier than Check Point and the Check Point had a lot of similar capabilities. It also offered finer filtering on what was going to be allowed through various parts of the firewall ports. 

I'd rate the solution ten out of ten due to its reliability and ease, and the consistency of configuration.

We have eight VFDs. We have the bigger firewalls. I forget the model number but they're the bigger ones. We have smaller ones—the 220s— so we have a pretty good range of Palo Alto firewalls that we use in our company.

One of the most valuable features is Palo Alto's firewall management. We find it easier to manage the firewall centrally.  

In the past, we've had trouble with Palo Alto's application filtering not getting it right. I would not be recommending layer 7 application filtering yet. That's the only hiccup with the product line. In terms of the features, I'd like to see, one of the bigger pieces missing from any firewall system is the ability to monitor and report. I don't think there are any firewalls doing this, but I'd like to see firewalls have the ability to do what Splunk is doing automatically. In other words, the ability to provide log analysis and monitoring from a visualization standpoint would be very beneficial to any firewall. That doesn't really exist today. 

There also needs to be a real methodology to maintain rules. They have rule sets in there and different ways of showing it, but the presentation isn't great. It's not a great presentation of where you have duplicate rules in place that makes it easy to find. Then again, I would say that no firewall company really has good management abilities for that. This isn't to badmouth Palo Alto. It's just that these features don't exist. So as we talk about where threat modeling and cybersecurity need to go, there's no one vendor with the best solution. It'd be nice if it would come in one platform. In other words, you buy their product, and they have a platform that includes that functionality.

We've used Palo Alto for nearly five years now. We formerly used Check Point exclusively, but now we're using Palo for all of our perimeter security and our VPN connection coming in.

Capability-wise, I think Palo Alto firewalls can pretty much handle anything thrown at them. 

I haven't done a lot with tech support. But the guys that are doing it say that outside support from Palo Alto is really good.

Check Point and Palo Alto are very similar as far as the platform's concerned. On the low-end side, maybe for smaller solutions, Check Point firewalls seem to do just fine and are even a little better. Their low-end products are better as far as performance is concerned. At the high-end, they can't touch the Palo Altos. The Palo Altos seem to be significantly better at handling more load and they can service larger throughput in their environment. I would say Palo Alto, overall, has a better, more reliable product line.

I would rate Palo Alto firewalls an eight out of 10.

We primarily use the solution as a next-generation firewall.

This company is a leader in the space.

The company is inventive and always adds a lot of great features.

The support on the solution is excellent.

The initial setup is pretty easy.

The company needs to align better with the customer. At the price point they offer, they need to be as good or better than the competition. They're losing market because they aren't there yet in that regard.

When it comes to renewing the solution, they tend to try to jack up the pricing.

We've been using the solution for almost five years now.

From a hardware point of view, we don't face any issues whatsoever. It's not glitchy or buggy. It doesn't crash. it's reliable.

The technical support has been excellent. We've very satisfied with the level of service they provide. It's one of the main selling features of the product.

Compared to the competition, support is excellent across the board.

We don't find the solution to be overly complex in terms of the initial setup. They make their implementation process pretty clear.

The deployment can happen in one week. It doesn't take too long. Sometimes, if you are new to the product, it might take a month or so.

We tend to use consultants when we implement the solution.

The licensing costs are too high. They need to become more competitive in that regard. We constantly need to bargain to get better pricing.

They tend to take advantage once the product has been sold to us. From a renewal point of view, the price is very high. They are demanding. That itself is creating a bad mark on them.

From a cost perspective, I'd rate the solution two out of ten.

I am trying to avoid Palo Alto, even though they have a very good solution, specifically due to the cost. 

We're just a customer.

From a technical support perspective, I'd easily rate them nine out of ten. If they didn't try to price gouge on renewals, I'd likely rate them higher.

Due to their pricing strategy, especially around renewals, I would not recommend them. We have 20+ firewalls, and we feel the heat when it comes time to renew the solution.

Palo Alto has an approach that makes the configuration easier not only for the customers but also for the IT help for the customers. 

In terms of what needs improvement, Palo Alto is lacking abilities that other firewalls can do. They disable the current sessions when you think the hardest part is done. They have a workaround for authentication, but then our clients just use the local database of the device itself.

Some of the small to medium businesses are using these features and it would be easier for us to upsell the product up to other networks. Palo Alto Networks is quite a bit higher when it comes to prices. They should implement the features that the other firewalls have.

In the next release, I would like for them to include a checkbox where the user could disable concurrent users of the portal.

I have been using Palo Alto Networks K2-Series for six months. 

When it comes to bug fixes, bugs will be fixed through a software upgrade or another fix.

Scalability is easy to do because we just have to know the number of users.

If I'm going to rate the support of Palo Alto, I would give it an 8 out of ten because they have good engineers, but sometimes I think that they take too long to respond to my queries. But most of them are very good.

The initial setup is easy. I have very little knowledge really in procedures, but I could connect to the internet and it was easy to follow when initially configuring the firewall.

The time to configure will depend on the client. If the client is just a small to medium business it will only take a day or two to configure it.

My advice to someone considering this solution would be that it's okay to spend a bit higher on your security products because Palo Alto is a bit more expensive than other products, but it is definitely worth it. The granularity of Palo Alto gives you more control over the security of your network.

I would rate this solution an eight out of ten. 

We are a system integrator and this Palo Alto K2-Series is one of the firewall products that we implement for our customers.

This firewall is very good for our customers because they don't have to write their own rules for adding an application.

The WildFire feature is very good.

Using Panorama and the web interface makes it easy to manage.

The reporting functionality in GlobalProtect needs to be improved. Other products, such as Check Point, have better reporting features that give more reports.

The price of the K2-Series should be lowered.

The dashboard could be improved by adding more GUI components.

We have about three years of experience with the Palo Alto K2-Series in my company, although I have only been working with this solution for about one year.

Palo Alto is very stable. In my previous job, I had not faced any stability issues.

All of the higher-level Palo Alto products are scalable.

We are the first level of support for our customers. If the problem is very complicated and we cannot solve it then we open a case through the distributor, which is the second level. After that, if they cannot solve it, the case is escalated directly to the Palo Alto technical team. Generally, if we cannot solve it then the distributor cannot either.

We also have experience with Check Point firewalls, as well as with solutions from Fortinet. I think that Palo Alto is better than Check Point in terms of threat prevention, and both of these are better than Fortinet. Palo Alto, however, is very expensive compared to Fortinet.

Check Point has better reporting and a better dashboard but is more difficult to install. Price-wise, they are similar.

The initial setup is very easy compared to Check Point. It is not hard for me to install and configure features such as High Availability.

We implement and deploy this solution for our customers. We also provide maintenance and support.

Palo Alto firewalls are very expensive.

I would rate this solution a nine out of ten.